CVE-2026-1115

Katalog CVE

CVSS 9.6 · Critical EPSS 1,3%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada lollms. Skor CVSS 3.0 9.6 (Critical) menurut huntr.dev.

Deskripsi (NVD)

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`, where user-provided content is directly assigned to the `DBPost` model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

9.6 (Critical), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a patch
• https://huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aa exploit · advisory pihak ketiga